20 Percent of CVEs Listed in CISA’s Latest Directive have Ransomware Associations

A directive recently released by the US government-backed Cybersecurity and Infrastructure Security Agency has a list of 703 known vulnerabilities that organizations have been asked to focus on patching immediately. Amongst the vulnerabilities, 158 vulnerabilities have been identified as being exploited actively by various ransomware families. Read on to learn more about the vulnerabilities.

On November 03, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released a list of known exploited vulnerabilities in a directive aimed at organizations from all sectors. With regular upates to the list, the final count now stands at 703 KEVs. The CISA list puts special emphasis towards patching known and exploited vulnerabilities associated with software and hardware commonly found on the US federal information systems, and those used by third party agencies.

On November 15, 2021, CISA published a list of vulnerabilities as part of the Industrial Control Systems Advisory (ICSA) that are found in data distribution and implementation service software.

Our security analysts took a deeper look at the list and discovered that several of the vulnerabilities have been exploited by or are associated with multiple ransomware groups. 

CSW Ransomware Reports Call Out 157 of the 158 vulnerabilities

CSW experts have mentioned 157 of the 158 vulnerabilities that have ransomware associations in the Ransomware Spotlight Report 2021 and 2022, and their subsequent index updates.

We have also identified a total of 138 unique ransomware groups that are associated with the ransomware vulnerabilities in CISA’s KEVs. Our researchers have also noted that out of a total of  158 ransomware vulnerabilities, 86 vulnerabilities are also actively exploited by Advanced Persistent Threat (APT) groups.

CVEs with Most Ransomware Associations

The top five CVEs with the highest number of ransomware family associations include:

Top Vendors Affected by Ransomware

Our research on the vendors most affected by ransomware puts Microsoft at the top of the list with 737 affected products, and Apache in second position with 607 products.

Here is a detailed insight into the Top Vendors Affected by Ransomware.

Top Products Affected by Ransomware

Our analysts noted that Oracle’s Java Software Environment  was the worst hit by ransomware and accounted for 497 affected products. VMWare’s ESXi and Horizon DaaS Appliances take the second spot. The Apache Log4j logging library that created a security storm in late 2021 comes in third with 378 affected products, closely followed by Microsoft Windows, Windows Server and the popular Office suite. Zoho ManageEngine Self Service engine makes the cut into the top five most affected products.

Top Trending CVEs

There are a total of 138 CVEs that are trending, of which Microsoft has a majority of products. Of these  vulnerabilities, our team of expert pentesters have prioritized a handful of them for further research. Here is an in-depth analysis of the trending CVEs selected by our researchers which have the largest impact:

Ransomware CVEs that Ought to be Patched in June 2022

Out of the 138 most trending vulnerabilities, CISA has identified 3 that need to be patched by June 2022.

For an overall analysis of all CISA warned vulnerabilities, and those that need to be addressed immediately, refer to our blog.

Fix these Vulnerabilities Now! Conduct Regular Ransomware Pentesting Assessments to Secure your Attack Surface.

Of the known and exploited vulnerabilities that CISA places emphasis on in their directive for organizations to patch,  vulnerabilities with ransomware associations require immediate attention and urgent patching.

At CSW, our expert pentesters and security researchers can help you prioritize the patching of the ransomware vulnerabilities and ensure that all organizations meet the deadlines set by the directive.

CSW experts believe that organizations that conduct monthly or quarterly ransomware penetration assessments have a greater chance of identifying and fixing vulnerabilities that can potentially affect their systems, thereby ensuring a secure attack surface. This in turn helps to improve an organization’s cyber hygiene, reinforces security management teams and boosts brand reputation.

Worried about how susceptible your organization is to a ransomware attack? 

Get a Ransomware Penetration Test done today! 

Click here to talk to us.